0

The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required additional verification before I could log in to my accounts on their websites. Google gave me a message that my device was unknown or could not be verified and required that I either provide a backup email or phone to receive a confirmation code before proceeding. Amazon required me to enter an emailed code. AOL didn't seem to notice or care.

But my actual device that I was using to connect to these websites has not changed. It is the same computer I have always used. My IP address probably changed with the new gateway, but the cable company has always assigned new IP addresses several times per year and it has never triggered a security lockout by Google or Amazon. Previously I would get the occasional e-mail notification that a sign-in was made on a new device (either "Linux" or "Windows" depending on which OS I was using), but nothing was ever triggered by getting a new IP. (see note*)

Based on my understanding of a similar question asked on Quora it would be highly irregular if my router hardware were known to websites.

What about the installation of a new gateway could trigger account lockout protocols for Google and Amazon? Does anyone know what might be going on here?

*Note: per the accepted answer, it seems that along with the new gateway, I was also assigned a much different IP address than any I've previously had. My previous IP addresses had always been in the range 73.xxx.xxx.xxx, but my new IP is in the range 67.xxx.xxx.xxx. I suppose this was different enough to be considered "suspicious activity" and triggered their account lockout protocols.

Improve this question

1 Answer 1

Reset to default
2

Normally your ISP assigns you IP Addresses within the same segment. e.g. an IP Address in the rang 20.40.0.0 - 20.40.255.255 (20.40.0.0/16). Google and Amazon trust your cookies and credentials in that segment once logged in successfully.

Now the interresting stuff:
If you got a new gateway, maybe your ISP also changed the way you access the internet (e.g. gateway supports new protocols), which caused them to assign you an entirely different IP Address (e.g. 55.123.45.67). That looks to google like someone stole your cookies and tried to login from somewhere else, in which case the go the safe route and just invalidate your session and log you out.
The worst case in that for Google is, that you need to relogin, which should be easy if that account actually belongs to you.

Also a question for you: Why is this question tagged ipsec? ipsec is a VPN protocol (https://en.wikipedia.org/wiki/IPsec)

Greetings

Improve this answer
3
  • 1
    I don't think it could be the cookies, since I have by browser set to delete cookies and cache whenever the browser is closed. And the browser had been closed and the computer shutdown in the time between the previous gateway dying and the new one being installed. However your idea about the IP appears to be correct. When I check my account activity on Gmail, it shows the last 7 IP addresses and the one I have now is completely different that the previous 6. I think this answers my question - thank you very much! Regarding the IPsec tag, that was my error and I have removed it.
    – fuzzydrawrings
    Commented May 31, 2020 at 18:35
  • Oh, regarding "The worst case in that for Google is, that you need to relogin" - it actually wouldn't let me do that even though I have the correct password. I had to provide a phone number and be given a verification code. Amazon did this also (but only required I retrieve the "otp" they sent to my email). Kind of an extreme security measure considering I had the correct password, but I guess that's Google/Amazon for you.
    – fuzzydrawrings
    Commented May 31, 2020 at 18:40
  • google and amazon ALWAYS require a second token (e.g. sms or authenticator) for a login on an untrested device or internet connection. Factory Reset your phone? 2 factor; new isp? 2 factor; google is weird? 2 factor; a bag of rice has fallen over? 2 factor. And yes it is the cookies: no cookies -> always 2 factor
    – Pingger Shikkoken
    Commented May 31, 2020 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .